d62ebe144ad75058dff37d69ac7746d5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d62ebe144ad75058dff37d69ac7746d5_JaffaCakes118
Size

103KB
MD5

d62ebe144ad75058dff37d69ac7746d5
SHA1

b7b4e1ff485ed6d0a9dd7fe9208b87b69428b6a6
SHA256

487ff158bf477f231ae932a8c71bfc0954daa56467e5c904ca5930a4fb1b3b13
SHA512

415516eabc72ddf5ecd94225d375d52e973cd7699b804d4d4c573ffc1a9ec13cf8d951cebe5061cc90212a38c265268444680c46e552f336c0d4e80ff2b93705
SSDEEP

3072:7ZhiLWDRf+qRB6JgNWmov1Pgb9vlW+0uimkKLXRyt4:9t+qRBu1t7mk0yt4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d62ebe144ad75058dff37d69ac7746d5_JaffaCakes118

Files

d62ebe144ad75058dff37d69ac7746d5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

776e2b086ba3dfa32c926c7ea7bd57dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
CreateEventW
SetNamedPipeHandleState
WaitForMultipleObjects
lstrcmpiW
FindNextFileW
CreateToolhelp32Snapshot
GetFileTime
DeleteCriticalSection
GetCurrentThreadId
ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetModuleFileNameW
GetUserDefaultUILanguage
ExitThread
SetThreadPriority
CreateTimerQueueTimer
GetTimeZoneInformation
Process32NextW
VirtualAlloc
GetExitCodeProcess
GetCommandLineA
CopyFileW
GlobalLock
GlobalUnlock
MapViewOfFile
CreateFileMappingW
GetModuleHandleA
OpenFileMappingW
lstrcmpiA
GetFileSize
SetFilePointer
ResetEvent
lstrcpyA
ConnectNamedPipe
CreateNamedPipeW
GetProcessTimes
DisconnectNamedPipe
lstrcatW
lstrcpyW
ExitProcess
GetThreadContext
SetThreadContext
SetErrorMode
GetCurrentProcessId
GetDriveTypeW
GetLogicalDrives
MoveFileExW
ReadFile
Thread32Next
HeapCreate
LeaveCriticalSection
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
GetThreadPriority
CreateFileW
HeapDestroy
GetVersionExW
ReadProcessMemory
Sleep
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
InitializeCriticalSection
WriteFile
WaitNamedPipeW
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
GetModuleHandleW
SetEvent
GetComputerNameW
WaitForSingleObject
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
GetNativeSystemInfo
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
Process32FirstW

user32

DefWindowProcA
ReleaseDC
GetWindowLongW
GetDC
GetClassLongW
BeginPaint
FindWindowW
WindowFromPoint
GetWindowInfo
GetParent
OpenWindowStationA
PostMessageW
GetIconInfo
GetTopWindow
RegisterWindowMessageW
GetMessageW
SetTimer
DestroyWindow
EndPaint
PeekMessageW
MsgWaitForMultipleObjects
CharLowerW
GetWindowThreadProcessId
CharLowerBuffA
DrawIcon
LoadCursorW
DispatchMessageW
GetWindow
DefWindowProcW
IsWindowVisible
RegisterClassW
CreateWindowExW
SendMessageTimeoutW
UnregisterClassW
OpenDesktopA
ExitWindowsEx
GetForegroundWindow
ShowWindow
GetCursorPos
TranslateMessage
GetKeyboardState
ToUnicode
CreateDesktopW
MapVirtualKeyW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetSystemMetrics
GetUserObjectInformationW
OpenWindowStationW
GetClipboardData

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegSetValueExA
RegCreateKeyExA
RegDeleteValueW
RegEnumKeyExW
GetUserNameW
LookupAccountSidW
DuplicateTokenEx

shlwapi

StrCmpNIW
SHDeleteKeyA
StrCmpNIA
StrStrW
wnsprintfA
wnsprintfW
wvnsprintfA
PathMatchSpecW
PathCombineW
PathRemoveFileSpecW
PathFindFileNameW
wvnsprintfW

shell32

SHGetSpecialFolderPathW

secur32

GetUserNameExW
InitializeSecurityContextW
AcquireCredentialsHandleW
FreeContextBuffer
EncryptMessage
QueryContextAttributesW
FreeCredentialsHandle
DecryptMessage
DeleteSecurityContext

psapi

GetModuleFileNameExW

ole32

CoCreateInstance

gdi32

CreateCompatibleBitmap
SelectObject
DeleteObject
GdiFlush
GetDIBits
CreateDIBSection
DeleteDC
BitBlt
GetDeviceCaps
CreateCompatibleDC

ws2_32

listen
closesocket
send
WSASend
WSAIoctl
getpeername
connect
WSAAddressToStringW
WSAStartup
recvfrom
getaddrinfo
select
WSAGetLastError
getsockname
shutdown
setsockopt
sendto
recv
bind
socket
freeaddrinfo
WSASetLastError
accept

crypt32

CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore

wininet

DeleteUrlCacheEntryW
HttpAddRequestHeadersA
InternetGetCookieA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetOpenUrlA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA
FindFirstUrlCacheEntryW
FindCloseUrlCache
HttpSendRequestW
FindNextUrlCacheEntryW

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data1
Size: 512B - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

776e2b086ba3dfa32c926c7ea7bd57dd

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

psapi

ole32

gdi32

ws2_32

crypt32

wininet

Sections

.text Size: 95KB - Virtual size: 95KB

.data Size: 1024B - Virtual size: 26KB

.reloc Size: 5KB - Virtual size: 5KB

.data1 Size: 512B - Virtual size: 3KB

.text
Size: 95KB - Virtual size: 95KB

.data
Size: 1024B - Virtual size: 26KB

.reloc
Size: 5KB - Virtual size: 5KB

.data1
Size: 512B - Virtual size: 3KB